CISA orders federal agencies to patch exploited Pixel modem zero-day in three days

Google disclosed that attackers actively exploited CVE-2026-58704, a high-severity flaw in the cellular modem of Pixel smartphones, before a fix was available. The defect allows an adjacent attacker to escalate privileges without any user interaction, such as clicking a link or answering a call. Google said in its September Pixel security bulletin that there are indications the flaw may have been under limited, targeted exploitation. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and directed affected federal agencies to remediate within three days. Google patched the flaw in its September 2026 Pixel security release alongside more than 100 other device-specific fixes.